Case Study · Security × Automation · SaaS & Cloud Engineering Teams
Eliminating CVE alert fatigue with call-graph reachability
Built an automated vulnerability triage pipeline that combines five open scanners with exploit telemetry and code reachability so engineers fix real risks instead of chasing false positives.
Target Sector
SaaS & Cloud Engineering Teams
- Python
- TypeScript
- Nuclei & Trivy
- CISA KEV / EPSS
- Docker
- Linux
Verifiable Operational Outcomes
Unified Scanner Stream
Code, secrets, containers & network
Exploit Prioritization
Filtered by AST call-graph usage
Remediation Briefs
Actionable context for developers
Security and engineering teams were overwhelmed by thousands of unranked scanner findings across containers, dependencies, secrets, and network ports — spending days manually cross-checking CVEs that were never actually called in production code.
- Disparate JSON/SARIF outputs from container, SAST, secret, and network scanners created duplicate and conflicting tickets.
- Over 80% of flagged transitive dependency CVEs lived in unused code paths that could never be triggered at runtime.
- Developers lacked clear exploitability context, delaying release sign-offs and compliance audits.
Orchestrated Nuclei, Trivy, Gitleaks, Opengrep, and Nmap into a unified ingestion pipeline that cross-references every CVE against CISA KEV and EPSS scores, parses AST call-graphs to verify dependency reachability, and generates plain-English remediation briefs.
03 · Production Verification
Verified against real-world multi-service repositories containing known reachable and unreachable CVEs, confirming deterministic separation of active exploit paths from dormant transitive packages.
Implementation Architecture
How the system was engineered step by step
Normalize findings across code, containers, secrets & ports
Aggregated Nuclei, Trivy, Gitleaks, Opengrep, and Nmap outputs into a single deduplicated schema with asset and repository lineage.
Correlate CISA KEV, EPSS, and call-graph execution paths
Matched every CVE against CISA Known Exploited Vulnerabilities and EPSS probability feeds while parsing source ASTs to check if vulnerable symbols are actually imported and called.
Generate plain-English fix briefs for engineering teams
Replaced cryptic scanner dumps with ranked remediation cards showing exact file paths, upgrade targets, and exploitability rationale.
Inspect the Live Reference Implementation
Experience this architecture in our live platform builds
Reference AppSec & Reachability Triage Platform